docs: def create_primary(user_id, pubkey, signer_func, secret_bytes=b''):
      """Export new primary GPG public key, ready for "gpg2 --import"."""
      pubkey_packet = protocol.packet(tag=(5 if secret_bytes else 6),
                                      blob=(pubkey.data() + secret_bytes))
      user_id_bytes = user_id.encode('utf-8')
      user_id_packet = protocol.packet(tag=13, blob=user_id_bytes)
      data_to_sign = (pubkey.data_to_hash() + user_id_packet[:1] +
                      util.prefix_len('>L', user_id_bytes))
      hashed_subpackets = [
          protocol.subpacket_time(pubkey.created),  # signature time
          # https://tools.ietf.org/html/rfc4880#section-5.2.3.7
          protocol.subpacket_byte(0x0B, 9),  # preferred symmetric algo (AES-256)
          # https://tools.ietf.org/html/rfc4880#section-5.2.3.4
          protocol.subpacket_byte(0x1B, 1 | 2),  # key flags (certify & sign)
          # https://tools.ietf.org/html/rfc4880#section-5.2.3.21
          protocol.subpacket_bytes(0x15, [8, 9, 10]),  # preferred hash
          # https://tools.ietf.org/html/rfc4880#section-5.2.3.8
          protocol.subpacket_bytes(0x16, [2, 3, 1]),  # preferred compression
          # https://tools.ietf.org/html/rfc4880#section-5.2.3.9
          protocol.subpacket_byte(0x17, 0x80),  # key server prefs (no-modify)
          # https://tools.ietf.org/html/rfc4880#section-5.2.3.17
          protocol.subpacket_byte(0x1E, 0x01),  # advanced features (MDC)
          # https://tools.ietf.org/html/rfc4880#section-5.2.3.24
      ]
      unhashed_subpackets = [
          protocol.subpacket(16, pubkey.key_id()),  # issuer key id
          protocol.CUSTOM_SUBPACKET]
  
      signature = protocol.make_signature(
          signer_func=signer_func,
          public_algo=pubkey.algo_id,
          data_to_sign=data_to_sign,
          sig_type=0x13,  # user id & public key
          hashed_subpackets=hashed_subpackets,
          unhashed_subpackets=unhashed_subpackets)
  
      sign_packet = protocol.packet(tag=2, blob=signature)
      return pubkey_packet + user_id_packet + sign_packet